Command-line interface for VirusTotal (with examples)

VirusTotal is an online service that analyzes files and URLs for possible viruses, malware, and other threats. The VirusTotal Command-line Interface (vt) provides a convenient and powerful way to interact with VirusTotal’s API from the command line. In this article, we will explore different use cases of the vt command with code examples.

Scan a specific file for viruses

To scan a specific file for viruses, you can use the following command:

vt scan file path/to/file

Motivation: Scanning files for viruses is crucial to detect any potentially harmful content. By using the VirusTotal CLI, you can quickly and efficiently scan files without leaving the command-line environment.

Explanation:

• scan: The scan subcommand indicates that we want to perform a file scan.
• file: This option specifies that we are scanning a file.
• path/to/file: The path to the file that we want to scan.

Example output:

File queued for analysis.

Scan a URL for viruses

To scan a URL for viruses, you can use the following command:

vt scan url url

Motivation: URLs can also contain malicious content, so it is essential to check their safety before visiting them. The VirusTotal CLI allows you to quickly scan URLs and obtain information about their safety.

Explanation:

• scan: The scan subcommand indicates that we want to perform a URL scan.
• url: This option specifies that we are scanning a URL.
• url: The URL that we want to scan.

Example output:

URL queued for analysis.

Display information from a specific analysis

To display information from a specific analysis, you can use the following command:

vt analysis file_id|analysis_id

Motivation: After scanning a file or URL, you might want to retrieve the analysis results and gather more information about the detected threats. The VirusTotal CLI provides the ability to fetch and display detailed analysis reports.

Explanation:

• analysis: The analysis subcommand indicates that we want to retrieve analysis information.
• file_id|analysis_id: The unique identifier of the file or analysis for which we want to retrieve information.

Example output:

Detailed analysis report:
- Analysis ID: abcdef1234567890
- Results: Clean
- Additional information: ...

Download files in encrypted .zip format

To download files from VirusTotal in an encrypted .zip format, you can use the following command:

vt download file_id --output path/to/directory --zip --zip-password password

Motivation: Sometimes, you may need to download files that were previously uploaded to VirusTotal for further analysis. The VirusTotal CLI allows you to conveniently download files in an encrypted .zip format with a password.

Explanation:

• download: The download subcommand indicates that we want to download a file.
• file_id: The unique identifier of the file that we want to download.
• --output path/to/directory: This option specifies the directory where the downloaded file will be saved.
• --zip: This option indicates that the file should be downloaded in the encrypted .zip format.
• --zip-password password: This option specifies the password for the encrypted .zip file.

Example output:

File downloaded and saved to path/to/directory/file.zip.

Initialize or re-initialize vt to enter API key interactively

To initialize or re-initialize vt in order to enter the API key interactively, you can use the following command:

vt init

Motivation: In order to use the VirusTotal CLI, you need to provide your API key. The initialization command allows you to conveniently enter the API key interactively, making it easier to manage and use the CLI.

Explanation:

• init: The init subcommand initializes or re-initializes the VirusTotal CLI.

Example output:

Enter your VirusTotal API key: xxxxxxxxxxxxxxxxxxxx
API key successfully configured.

Display information about a domain

To display information about a domain, you can use the following command:

vt domain url

Motivation: Understanding the reputation and history of a domain is important for cybersecurity and assessing potential risks. By using the VirusTotal CLI, you can quickly obtain information about a domain, such as its category, associated IP addresses, and latest analysis results.

Explanation:

• domain: The domain subcommand indicates that we want to retrieve information about a domain.
• url: The URL of the domain for which we want to obtain information.

Example output:

Domain Report:
- Category: Social
- Last Analysis Date: 2022-01-01
- Associated IP Addresses: 1.2.3.4, 5.6.7.8
- Latest Analysis Results: Clean

Display information for a specific URL

To display information for a specific URL, you can use the following command:

vt url url

Motivation: URLs can be a gateway to malware or phishing attempts. By using the VirusTotal CLI, you can quickly check the reputation and safety of a URL, making informed decisions when visiting websites.

Explanation:

• url: The url subcommand indicates that we want to retrieve information about a URL.
• url: The URL for which we want to obtain information.

Example output:

URL Report:
- Analysis Results: Clean
- Number of Engines Detected: 2

Display information for a specific IP address

To display information for a specific IP address, you can use the following command:

vt ip ip_address

Motivation: IP addresses can be associated with malicious activities or serve as command and control servers. By using the VirusTotal CLI, you can quickly obtain information about an IP address, such as its reputation, related domains, and communication history.

Explanation:

• ip: The ip subcommand indicates that we want to retrieve information about an IP address.
• ip_address: The IP address for which we want to obtain information.

Example output:

IP Report:
- Reputation: Malicious
- Associated Domains: example.com, maliciousdomain.com
- Communication History: Number of connections: 100, Date of last connection: 2022-01-01

In this article, we explored various use cases of the VirusTotal CLI (vt) command. From scanning files and URLs for viruses to retrieving analysis reports and obtaining information about domains, URLs, and IP addresses, the VirusTotal CLI offers a convenient and powerful way to interact with VirusTotal’s API from the command line. By incorporating these example use cases into your workflow, you can enhance your cybersecurity practices and stay informed about potential threats.